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DECISION: 
Appeal dismissed with costs 


JUDGMENT: 


IN THE SUPREME COURT 
OF NEW SOUTH WALES 
COURT OF APPEAL 


CA 40819 of 2004 


HANDLEY JA 
HODGSON JA 
HUNT AJA 


27 OCTOBER 2005 
CRAIG WRIGHT v MICHAEL RYAN & ANOR 
CATCHWORDS 


APPEAL -— fresh evidence — additional evidence — requirements for in appeal from conviction for contempt of 
Court 


EVIDENCE - circumstantial — repetitive conduct 


EVIDENCE - fresh evidence — additional evidence — requirements for in appeal from conviction for contempt 
of Court 


FACTS 


The Supreme Court found the appellant guilty of contempt of Court by breaching undertakings given to the 
Court involving the carrying on of business in competition with and approaching customers of the second 
respondent. The appellant argued that the undertakings were too ambiguous and uncertain to be enforced, that 
certain companies were not customers of the second respondent and that he had not breached the undertakings. 

The appellant also sought to adduce fresh evidence in the appeal. HELD: (1) The appellant had breached the 
undertakings given to the Court. Circumstantial evidence established repetitive and continuous conduct of a 
kind that excluded as unreasonable any explanation other than the carrying on of a business: Martin v Osborne 
(1936) 55 CLR 367, 375-6 and Hope v Bathurst City Council (1980) 140 CLR 1, 8-9; (2) Acceptance of a 
business proposition from one of the second respondent’s customers was sufficient to breach the undertaking not 
to approach the second respondent’s customers; (3) The reception of the fresh evidence in this appeal from a 

conviction for a criminal offence was governed by s 75A(8) of the Supreme Court Act, but semble it may be 

appropriate in such an appeal for the Court to apply the less stringent tests applicable in appeals to the Court of 
Criminal Appeal: Ratten v The Queen (1974) 131 CLR 510 and Gallagher v The Queen (1986) 160 CLR 392 
referred to; (4) The fresh evidence was not capable of giving rise to a reasonable doubt as to the appellant’s 

guilt. 


ORDERS 


Appeal dismissed with costs. 


IN THE SUPREME COURT 
OF NEW SOUTH WALES 
COURT OF APPEAL 
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CA 40819 of 2004 


HANDLEY JA 
HODGSON JA 
HUNT AJA 


27 OCTOBER 2005 
CRAIG WRIGHT v MICHAEL RYAN & ANOR 
Judgment 


1 HANDLEY JA: On 31 August 2004 Gzell J found the appellant guilty of contempt of Court by 
breaching undertakings given to the Court on 4 September 2003. The breaches involved carrying on business in 
competition with DeMorgan Information Security Systems Pty Ltd (the company) and directly or indirectly 
approaching “any company, business, entity or person who is or was, as at 8 August 2003 a customer of [the 
company]”’. On 15 November Gzell J sentenced him to imprisonment for 28 days suspended on condition that 
he perform 250 hours of community service, and he was ordered to pay the costs of the proceedings. 


DD His appeal, which lay as of right under the Supreme Court Acts 101(3), relevantly asserted (grounds | - 
10) thatthe undertakings were too ambiguous and uncertain to be enforced, and challenged the Judge’s findings 
that News Ltd, Australian Stock Exchange Ltd (ASX) and Rail Infrastructure Corporation (RIC) were customers 
ofthe company (ground 11) and that he had committed breaches of the undertakings (grounds 12-14). 


3 The appellant did not give evidence at his trial, but relied on an affidavit in the proceedings on sentence 
when he was cross-examined. The affidavit sought to challenge the Judge’s findings on guilt, and was 
successfully objected to on this ground. The Judge admitted the affidavit ona limited basis,as relevant to the 
appellant’s state of mind, and his cross-examination was limited on the same basis. 


4 The appeal was initially fixed for 19 May 2005 but the appellant sought, at a late stage, to rely on an 
affidavit, said to be fresh evidence ofa highly technical nature, relating to an email which the Judge found he 
had sent to RIC at 11.23 am on 10 September 2003. The hearing was adjourned and Hodgson JA ordered the 
appellant to pay a lump sum for the costs ofthe respondent thrown away and he was directed to file any further 
evidence within 14 days. His affidavit of 9 June was filed a few days late. Directions had also been given for 
the filing of evidence by the respondent in answer, but not for the filing of evidence in reply. The appeal was 
later fixed for 30 and 31 August. 


D The respondent filed an affidavit by himself of 11 July and an affidavit by Mr Taylor from Charles 
Sturt University (CSU) of 13 July. 


6 The appellant filed a further affidavit dealing with technical issues relevant to the authenticity of the 
disputed email on 23 August,and onthe morning of 30 August he sought to rely on yet another technical 
affidavit he had sworn that day that counsel for the respondent only received that morning. 


7 The Court upheld the respondent’s objection to the affidavit of 30 August because ofits late service 
and the prejudice to the respondent which would have necessitated a further adjournment. Counsel for the 
respondent also objected to the affidavit of 23 August but frankly conceded that he was in a position to deal with 
it in cross-examination and address. That affidavit contained what, in substance, was evidence in chief, which 
should have been included in an affidavit filed within the time fixed by Hodgson JA, but the Court decided not 
to reject it on procedural grounds. 


8 Mr Burton SC, appearing for the appellant, then sought an adjournment to enable the affidavit of 30 
August to be read at the adjourned date but, following lengthy argument, this application was refused. During 
the argument it became clear that the affidavit of 30 August contained extensive material which properly formed 
part of the appellant’s case on the fresh evidence application and strictly did not arise in reply to the affidavits of 
Mr Ryan and Mr Taylor. This should have been included in an affidavit filed within the time fixed by Hodgson 
JA. The appellant had already received the indulgence of one adjournment based on the late filing and service 
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ofa technical affidavit shortly before the hearing date on 19 May and we considered that there was no proper 
basis for granting a further indulgence, particularly as the delay was not explained. 


9 The Court then heard the appellant’s application for leave to adduce further evidence in the appeal. 
This comprised his affidavits of 9 June and 23 Augustand certain exhibits, and possibly his affidavit of 14 
October 2004 filed in the sentence proceedings. 


10 The further evidence was essentially directed to an email apparently sent by the appellant to Mr David 
Spencer of RIC at 11.23 amon 10 September 2003 (the disputed email). The appellant did not give evidence at 
his trial, but the respondent tendered that part of his affidavit of 24 October 2003 (blue 113) where he denied 
sending that email. 


11 A copy of the disputed email was found on the hard drive of the appellant’s computer when an Anton 
Pillar order was executed athis home at Bagno near Mt White on 16 September 2003. The email purported to 
come from “Craig S Wright [cwrigh20@postoffice.csu.edu.au]”, and was sent to “Spencer, Dave; 
Wright_c@demorgan.com.au; Spencer, Dave”. It stated: 


“More details to follow (ie proposal) 


But to monitor patching etc and provide documents for updates etc for 3 linux check point 


hosts 
il. Patch info for systems and services. 
os Emergency fix info. 
3. Support on updates inc procedures where necessary. 


4. Help with upgrades 
$450 per month ex GST ($150 per system) 
Regards 
Craig S Wright” 


12 The disputed email was received by RIC and at Mr Wright’s email address at the company. The Judge 
drew the inference that it was sent using Mr Wright’s email address to RIC and to his email address at the 
company and a copy was retained onhis computer. This email formed the basis of the Anton Pillar order 
obtained by the plaintiffs which was executed on 16 September. The appellant in his affidavit of 14 October 
2004 filed in the proceedings on sentence again denied sending this email and gave reasons (blue 148) why he 
could not have offered to do the work at the rate quoted. He also said (blue 148-9): 


“IT have recently obtained copies of the access logs from [CSU] on-line servers for my user 
account to access email (being the account from which it is alleged that I sent the email of 10 
September 2003 to RIC). I have perused those logs and say that they disclose access to my 
account from proxy01.demorgan.com.au from August 2003 until November 2003. 
Proxy 01.demorgan.com.au is a secured server inside [the company’s] network and to which I 
have not had access since my resignation on 10 August 2003. The logs disclose access to the 
account from IP address 144.135.38.125 which is my IP address at the farm at Port Macquarie 
... The email dated 10 September 2003 ... was sent from IP address 144.135.104.27 which is 
not my IP address and which I have traced to an address in Melbourne.” 


13 In his affidavit of 9 June 2005 (orange 3) the appellant said that between 8 August and 23 October 
2003 he maintained two email addresses,one at CSU and the otherat the company, being his private address 
and his work address. He said that access to email at CSU was linked to the server email address my.csu.edu.au. 
To access that server and create a record in the logs at CSU (orange 4) he must log into CSU through the server 
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auth.csu.edu.au, and access the systemmy.csu.edu.au by using cwrigh20. and a password. Once one had validly 
logged into CSU one can access and use one’s private email systemand folders. 


14 He said that on 12 August he was excluded from the company’s premises and could no longer access 
its computer system. 


15 Before the trial he made inquiries at CSU for records of emails sent from his private email address, but 
was told there were no suchrecords. A relevant subpoena was served on CSU without result. He continued his 
inquiries after the trial and in December 2004 obtained an extract copy ofthe logs from CSU for August to 
October 2003 comprising about 60,000 pages. 


16 He searched those logs which disclosed that secure CSU systems including my.scu.edu.au were 
accessed from proxy01.demorgan.com.au on 2549 occasions between August and October, an average of 21 
times a day and he said that during that period he did not have access to nor did he access the address 
proxy01.demorgan.com.au. 


17 He said that the only persons who could have accessed that address were persons working within the 
premises of the company and that if such persons had been accessing his private address during that period 
“they could have created email messages purporting to come from me on that private address”. 


18 Mr Ryan said in his affidavit that the appellant still had in his possession after 12 August 2003 laptop 
and work-station computers owned by the company which were configured to access proxy01.demorgan.com.au 
(orange 9). This repeated a statement in his affidavit of 2 September 2003 (blue 7) which identified three of the 
computers by make and serial number and referred to anothertwo not so identified. 


19 Mr Taylor said that the information sought by the appellant from CSU before and after the trial was 
freely available on its website with no requirement for a login or password, and the relevant webpage was not 
hard to locate from its home page. It could have been accessed by an appropriate search at any time during 
2004. 


20 In his further affidavit of 23 August the appellant said: 


“T was never issued with a notebook/laptop at any time from [the company]. No computers 
owned by [the company] are, or have ever been, at my premises. The Dell host servers at my 
residence, which was searched pursuant to the Anton Pillar order on 16 September 2003, had 
different configurations from and were different makes from those used at [the company]. 
Further the serial numbers on the hosts were not those of the [the company] host’s.” 


Al He said (orange 15-16) that proxy01.demorgan.com.au_ was the Host name of the unix server used by 
the company to access clients’ sites and the Internet. It had a fixed and permanent IP address 203.34.22.195. 
The source of an email is the IP address ofthe systemused to construct it and it appears on the header. The IP 
address of the proxy server within the disputed email dated 10 September 2003 is 203.34.22.195 which was the 
source of the email internal to the company. 


22 The IP address 144.135.104.227 is a Telstra account in Melbourne and was not the sending IP of the 
disputed email. He said that it is an internal Telstra address and could not have been used to send the email as it 
is a secure dial in server at Telstra and does not run “a web client” (orange 16). The disputed email was sent 
from a web client. He said that the IP address for the Telstra server 144.135.104.27 listed in the header as the 
sending host of the email never had been his personal IP address. He had had the IP address 144.135.38.125 
since 2002 onthe Telstra two-way satellite link from his home until he had it changed in August 2005. He had 
an IP address on the Telstra 2-way satellite link from his home (orange 16). He also had a wireless network 
there during 2003 which the company was able to access (orange 17). 


23 On 10 September 2003 he made calls onhis mobile phone at about the time the disputed email was sent 
which, according to his mobile phone accounts, were sent through Berowra (10.36 am), Cowan (11.09 am) and 
Berowra (11.48 am) (sup blue 2/467). He said therefore he could not have been at home at Bagno or able to 
access his home computer at 11.23 on 10 September when the disputed email was sent (orange 17). He disputed 
parts of Mr Taylor’s affidavit. 
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Admissibility of further evidence 


24 Section 75A(8) of the Supreme Court Act provides that on an appeal from a judgment after a trial or 
hearing on the merits “the Court shall not receive further evidence except on special grounds”. The Court has 
not attempted to exhaustively define what are special grounds for this purpose but the core concepts are those on 
which common law courts received fresh evidence ona motion for a new trial following the verdict ofa jury. 
These were considered in Parsons v McCann (1954) 93 CLR 418, Wollongong Corporation v Cowan (1955) 93 
CLR 435 and McDonald v McDonald (1965) 113 CLR 529. The evidence must be admissible and credible, and 
such that it could not have been discovered by the exercise of reasonable diligence before the trial. It must be of 
such probative value and significance that, taken with the evidence given at the trial, it will in all probability be 
decisive of the issues between the parties and result in a different verdict: McDonald v McDonald at 532 per 
Barwick CJ. 


2S Although this is an appeal from a conviction for a criminal offence the procedure is that which applies 
under the Supreme Court Act to appeals in civil cases. Under the Criminal Appeal Act 1912 the discovery of 
fresh evidence may lead the Court of Criminal Appeal to enter a verdict of acquittal in a sufficiently strong case, 
and in other cases to order a new trial. The focus in the Court of Criminal Appealis on whether there has beena 
miscarriage of justice. As Barwick CJ said in Ratten v The Queen (1974) 131 CLR 510, 517: 


“Great latitude must of course be extended to an accused in determining what evidence by 
reasonable diligence in his own interest he could have had available at his trial, and it will 
probably be only in an exceptional case that evidence which was not actually available to him 
will be denied the quality of fresh evidence.” 


26 At 520 he discussed the way in which the Court of Criminal Appeal can use further evidence: 


“... if the new material, whether or not it is fresh evidence, convinces the court upon its own 
view of that material that there has been a miscarriage in the sense that a verdict of guilty 
could not be allowed to stand, the verdict will be quashed without more. But if the new 
material does not so convince the court, and the only basis put forward for a new trial is the 
production of new material, no miscarriage will be found if that new material is not fresh 
evidence. But if there is fresh evidence which in the court’s view is properly capable of 
acceptance and likely to be accepted by a jury, and which is so cogent in the opinion of the 
court that, being believed, it is likely to produce a different verdict, a new trial will be ordered 
as a remedy for the miscarriage which has occurred because of the absence at the trial of the 
fresh evidence.” 


By The High Court affirmed these principles in Gallagher v The Queen (1986) 160 CLR 392, subject to 
some adjustments. The Court held (399, 402) that there will be a miscarriage of justice where “there is a 

significant possibility that the jury, acting reasonably, would have acquitted the applicant of the charge if the 
new evidence had been before it in the trial”. The Court also referred (396, 401) to the judgment of Rich and 
Dixon JJ in Craig v The King (1933) 49 CLR 429, 439 where their Honours said of fresh evidence in criminal 


cases: 
“Such evidence should be calculated at least to remove the certainty of the prisoner’s guilt 
which the former evidence produced.” 

28 Gibbs CJ discussed the requirements for due diligence (396): 
“... the conviction will not be usually set aside if the evidence relied on could with reasonable 
diligence have been produced by the accused at the trial ... [but] this is not a universal and 
inflexible requirement: the strength of the fresh evidence may in some cases be such as to 
justify interference with the verdict, even though that evidence might have been discovered 
before the trial.” 

29 This Court has not decided whether the tests applied unders 75A(8) in civil cases apply to appeals 


from criminal convictions for contempt of court or whether the Court should adopt the less stringent tests 
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applied in the Court of Criminal Appeal. This question was not fully argued and, without expressing any view 
on that question, we should apply the less stringent tests. 


30 It is strongly arguable that the appellant has not discharged the onus of establishing that CSU’s records 
ofemails sent through its server could not have been discovered before the trial by the exercise of reasonable 
diligence. The affidavit evidence of Mr Taylor appears to establish that it would have been a simple matter to 
discover their existence by searching CSU’s home page on its website. 


31 The appellant was cross-examined but Mr Taylor was not. He lives at Bathurst and notice for him to 
attend for cross-examination was not given until a day or so before the hearing. 


32 Since I have reached the firm conclusion that the appellant has not discharged the onus of proving that 
the further evidence is credible and would probably have been decisive, I am content to base my decision on 
those grounds without expressing a final opinion on the question of due diligence. 


33 The case against the appellant was based on circumstantial and documentary evidence. This included 
emails recovered on the Anton Pillar raid, or produced by third parties on subpoena. The plaintiffs also tendered 
the appellant’s mobile phone records and parts of his affidavits of 11 September and 24 October 2003. Finally 
they tendered the security records of the ASX showing visits by the appellant to its premises on 4, 8, 9, 11, and 
30 September and.15 and 24 October 2003. 


34 There were emails to and from RIC on 9 (two), 10 (five), 11 (two) and 30 September and to News Ltd 
on 22 and 23 October. The appellant’s mobile phone records disclosed calls to RIC on 8 (three), 9 (four), 10, 
15, 16 (four), 17 (two), 18 (five) and 29 September and 1, 2 (eight), 9 (three), 10, 14 (three), 20 (two) and 23 
October. The appellant’s affidavit of 11 September disclosed a further telephone call to RIC on 5 September. 


35 The records disclosed telephone calls to the ASX on 4 (two), 9, 11, 23, 26 and 29 September and | and 
9 October. There were also telephone calls to News Ltd on 15, 23, 24, 26 September and 1, 9 (four) and 23 
October, to the Human Rights and Equal Opportunity Commission on 18 October and four calls to Val Morgan 
on 30 September. There were also emails to News Ltd on 22 and 23 October. 


36 These facts, other than the authenticity of the emails of 11.23 am [para 11] and 11.16 am to RIC on 10 
September 2003 (sup blue 2/354) were not in dispute. 


37 In his affidavit of 14 October 2004 the appellant explained the background to the email of 11.16 am 
(blue 148 para 22), and denied sending the disputed email (para 23). In his affidavit of 9 June 2005 (orange 7) 
the appellant denied sending “emails” to RIC on 10 September 2003, and he repeated this denial in his affidavit 
of 23 August 2005 (orange 18 para 14). The denial in the plural was said by Mr Burton to refer to the emails of 
11.16 am and 11.23 am, and not the earlier emails that day. 


38 Subject to the submissions on legal questions which will be considered later, the circumstantial case 
against the appellant was overwhelming, evenif thedisputed email or emails are ignored. The relevant 
principles are those stated in Martin v Osborne (1936) 55 CLR 367, 375-6 per Dixon J: 


“Tf an issue is to be proved by circumstantial evidence, facts subsidiary to or connected with 
the main fact must be established from which the conclusion follows as a rational inference ... 
The circumstances which may be taken into account in this process of reasoning include all 
facts and matters which ... make intelligible the course of conduct pursued ... the acts ofa 
party are admissible against him whenever they form a component in a combination of 
circumstances which is unlikely to occur without the fact in issue also occurring. The 
repetition of acts or occurrences is often the very thing which makes it probable that they are 
accompanied by some further fact. The frequency with which a set of circumstances recurs or 
the regularity with which a course of conduct is pursued may exclude, as unreasonable, any 
other explanation or hypothesis than the truth of the fact to be proved.” 


39 It was not suggested that the furtherevidence actually established that the disputed emails were forged 


by the company. The submission was that they had not been sent by the appellant, but had been fabricated by an 
unknown person who was able to access the company’s computers as well as those ofthe appellant. Even if this 


Retrieved from AustLll on 22 May 2020 at 14:13:26 Verify version 


Case 9:18-cv-80176-BB Document 547-1 Entered on FLSD Docket 06/01/2020 Page 8 of 12 
Signed by AusiLll 


had been established the conviction would probably not have been quashed having regard to the strength of the 
general circumstantial case. 


40 The disputed email was found on a computer at the appellant’s home during the Anton Pillar raid on 16 
September 2003 (blue 109). It was found ona temporary Internet file opened and viewed during the raid when a 
copy to self folder used to store email messages online was accessed (blue 107, 108, 109). It had not originated 
on that computer, but had been sent from a remote location. However its presence in a “copy to self’ file 
supported an inference that it had been sent by the appellant. 


41 Mr Ryan said that a copy of the disputed email was received on the screen of his personal computer at 
the company’s premises (blue 51). After the appellant left the company Mr Ryan reprogrammed his computer 
to ensure that incoming emails directed to the appellant were sent to his computer (orange pp 8-9). 


42 The appellant said that after he left the company’s premises on 12 August 2003 he could no longer 
access its secured server as it was protected by a security systemknown as a firewall for which he needed a 
password, a user name and an access token. He said he had surrendered his token (orange 4). Mr Ryan said that 
an access token was not required for this purpose (T 109). 


43 The appellant said that he could not have sent the disputed email because he did not have access to 
computers which were configured to access proxy01.demorgan.com.au [para 18], but Mr Ryan said the 
appellant retained five computers belonging to the company which had this capacity. The appellant denied this. 
The appellant also said that proxy01.demorgan.com.au could only have been accessed by persons working 
within the company’s premises (orange 6(20)) but Mr Ryan said it could have been accessed from any computer 
anywhere in the world with the appropriate configuration (orange 9(10)). 


44 The appellant said that a third party could have accessed his secure email address at CSU to create and 
send the disputed email. Such a person would have needed to use the appellant’s username anda password 
(orange 4(5)), or else to successfully hack into the system. It was notestablished that anyone at the company 
had the appellant’s password or that his system had been penetrated. 


45 The appellant established that during September 2003 secure accounts at CSU had been accessed 
through its secure server, server online, from proxy01.demorgan.com.au, anothersecure server (T 96) 58 times 
(exs C, D) and from the Telstra IP address 144.135.104.27 170 times. The former established very little because 
it was not known which secure accounts at CSU had been accessed and it was not established that the 

appellant’s account had ever been accessed through proxy01.demorgan.com.au. There are probably thousands 
of such accounts which can be accessed through CSU’s server online for the University, its staff, and the 
students (T 84, 96), and the access obtained on the 58 occasions could have been to any account at CSU (T 96). 


46 The appellant said that the Telstra IP address 144.135.104.27 could not have been used to send the 
disputed email (orange 16). Mr Ryan said that it was an IP address allocated to Telstra undera portable 
allocation (T 98) for satellite usage (T 99). Authorised persons could use that IP address if they had access 
including portable access or could make use of satellite mechanisms (T 99). There was nothing on the copy 
search of 144.135.104.27 (ex E) to link that IP address toa satellite account or any particular satellite account (T 
117). 


47 According to the appellant the disputed email was sourced from a proxy server within the company 
with the IP address 203.34.22.195 (orange 16). He said in his oral evidence that it did not originate from this IP 
address but from somewhere in the company’s network that was connected to that machine (T 127). He said 
that the IP address 144.135.104.27, the Telstra account, which was the “supposed” sending IP of the email, 
could not have been used to send it (orange 16). Mr Ryan said that it could have been sent through the Telstra 
IP address by any one who had appropriate access (T 99). 


48 Mr Ryan called a colleague, Mr Dombrack, to view the disputed email on the server of his personal 
computer (black 81). Mr Dombrack went to the “properties” of the email “to determine how the email got sent 
to us” (93). In computer language he cut and pasted the properties on to a notepad which produced a header text 
file which he saved (black 82). A hard copy became part of ex C (sup blue 1/168). Using the information on 
this document he prepared a flow chart which traced the movements of the email which also became part of ex 
C (1/167). Material is added to the header of an email at each stage as it moves from server to server (91). 
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49 He said it was a web email “composed onthe CSU post office” (83), the mail server at CSU (84). His 
flow chart traced the disputed email from the mail server postoffice.csu.edu.au to Telstra’s Bigpond satellite 
service 144.135.104.27 (83) and also directly through an intermediate siteat CSU toa computer designated 
firewall — ns.demorgan.com.au which was the company’s firewall or security gateway designed to prevent its 
network being attacked from the Internet (85-6). The disputed email then passed to the company’s proxy server 
proxy01.demorgan.com.au where email coming from the Intemet is scanned (86) from where it passed to the 
company’s email server and then to Mr Ryan’s desktop PC (87). 


50 If Mr Dornbrack’s evidence was correct the disputed email originated from 
c_wright20@postoffice.csu.edu.au (92), a computer linked to CSU, and it was dispatched by the senderto the 
Telstra IP address and by different routes to the company and Mr Spencer. It did not originate at the company’s 
IP address 203.34.22.195 allocated to proxy01. That was its destination on this track. He said that the timing 
differences at the different stages within the company’s network were normal because the clocks on different 
pieces of computer hardware drift (88-9, 91). The appellant said in this Court when recalled that the company’s 
computers operated on synchronised time (T 128). This was not putto Mr Dornbrack during his cross - 
examination at the trial. 


51 The appellant said (orange 17-8) that if he had sent the disputed email it would have increased in size 
as it passed through each mail server until it reached the company. He said a comparison of the message source 
details for this email obtained from the company’s exchange server produced to the Court on 19 September 
2003 (orange 57-8) and the print out from the temporary Internet file downloaded from his computer during the 
Anton Pillar raid (blue 109) showed that its logical size had grown from 1687 to 4054. The appellant said that 
this indicated that it had originated at the company. The document at orange 57-8 contains more information 
about the source and movement of the email than the document produced by Mr Dornbrack (sup blue 1/168) 
already considered [para 50]. 


52 Mr Ryan said the document at orange 57 showed that the email did not originate from the company’s 
IP address 203.34.22.195 butcame through cwright20@postoffice.csu.edu.au (T 115-6). It did not show where 
it actually originated but it did not originate from 203.34.22.195 because thatis where it went (T 116). He said 
that the letters and figures “3f5e7d03” in the header sheets (orange 57-9) for the company’s exchange and mail 
servers constituted a unique message that indicated that the email was established by a computer outside the 
company (T 123). This was not denied by the appellant in his later evidence. Mr Ryan described how the 
documents at orange 57-9 were produced and agreed that data could be changed during this process (T 118). He 
did not prepare the documents himself. The appellant said that “it was a text edited record” and nota log and 
had no relevance (T 127). Mr Dornbrack probably prepared these documents [para 48] but he was not cross - 
examined at the trial to suggest that he had changed the data. 


53 In answer toa question from a member ofthe Court the appellant said (T 127) that “this”, the 
document at orange 57-8, showed that the disputed email “actually originated somewhere in their network. It 
originated within their network that connect to that machine (203.34.22.195)”. Whenasked by another member 
of the Court what there was within the document that showed that the disputed email originated in the 
company’s building (T 127) the appellant gave a long answer by instalments based on the earliest times and 
smallest size being recorded at the exchange server, increasing at the mail server, and again atthe firewall (T 
127-9). He said that the document did not contain all the necessary information (T 128, 129). The significance 
of the time sequences depended on his evidence that the company’s system was synchronised (T 128). This was 
contrary to the evidence given at the trial by Mr Dornbrack (black 88-9, 91). The appellant said that the email 
could have been sent by any of the machines in the company’s network (T 128(15), 129(50)). 


54 In his affidavit of 23 August the appellant said thatthe calls from his mobile phone on 10 September 
(sup blue 1/132) at 11.09 am and 11.48 am were shownas sent from Cowan and Berowra respectively so that at 
the time the disputed email was sent he must have been in his car approximately 20 minutes away from his 
home and could not have sent it (orange 17). 


55 The mobile phone records for 16 September show that this inference cannot be drawn. Times on the 
copy of the disputed email found on the appellant’s hard drive (blue 109) showed that the raid was in progress at 
11.47 am on 16 September. The appellant said that at that time he was outside his home using his mobile 
telephone (orange 17). His mobile phone records (sup blue 1/132) showthat he made phone calls at 11.33 am, 
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11.46 am, and 11.59 am. Thesetoo are shown to have been made from Berowra, as was one of those calls said 
to have been made by the appellant from his car 20 minutes drive from his home on 10 September. It is 
therefore clear that the mobile phone records for 10 September do not establish that the appellant was not at his 
home at 11.23 am when the disputed email was sent. 


56 The relevant emails to and from Mr Spencer of RIC of 10 September appearto start with one from the 
appellant at 12.40 am, although the text is notin evidence (sup blue 2/355-6). This produced a reply from Mr 
Spencer at 8.41 (356) and a response from the appellant at 8.44 (355). He said that he was then at Vodafone 
Chatswood and followed up this last email with a phone call to Mr Spencer (blue 148(21)). 


357 The email at 11.16 am (354) was acknowledged by the appellant as genuine in his affidavit of 14 
October 2004 (blue 148(22)). It was sent seven minutes after the appellant is recorded as making a call on his 
mobile phone from Cowan at 11.09 am. The disputed email followed at 11.23 am. The subject of both was 
described as “Re: specs”. The next email from the appellant at 12.27 pm that day showed as its subject “RE: 
Review Document”. It was sentin response to an earlier email from Mr Spencer recorded there but not shown 
independently (352). This seems to have been a response to an email sent by the appellant to Mr Spencer the 
day before (359) which referred to servers and was headed “Review Document”. On 30 September Mr Spencer 
sent a memorandum to the appellant (sup blue 2/318) which relevantly stated: 


“Thank you for submitting a quotation for block of security consultancy hours based around 
our current check point implementation. 


Unfortunately we will not be taking up your offer of services opting for a proposal supplied by 


another organisation.” 
58 This may have beena response to the disputed email (T 37). 
59 The disputed email was produced on subpoena by RIC along with the other emails passing between the 


appellant and Mr Spencer. It was apparently received without provoking any email response from Mr Spencer 
asking what it was all about. The parties were again in communication by email the following day (sup blue 
2/325, 347). 


60 It would have been extremely difficult for an outsiderto fabricate the disputed email containing the 
details it did [para 11]. Mr Spencer and the appellant communicated with each other many times on 9, 10 and 
11 September by email, telephone, and in person. Somehow this email managed to make sense and fit in with 
these othercommunications. The fabrication of such an email by an outsider without this being immediately 
detected by the recipient is glaringly improbable. A copy ofthe email reached the appellant. He replied to his 
emails without delay and if the disputed email had been sent to him by a third party he would have become 
aware of its existence almost immediately. 


61 The arguably fresh evidence of the email records from CSU is credible but completely neutral. It 
establishes that the company could have accessed the appellant’s email address at CSU in order to sent the 
disputed email, but does not prove that it did so or establish that as a matter of probability. This evidence leads 
nowhere. It is not capable of giving rise toa reasonable doubt about the appellant’s guilt and could not have 
produced a different result if it had been admitted at the trial. 


62 The other new evidence by the appellant relating to the disputed email was based on his interpretation 
and explanation of the header text file produced by Mr Dombrack (sup blue 1/168) and the message source 
details for that email produced to the Court under notice to produce on 19 September 2003 (orange 57-8). These 
documents were in evidence or available at thetrial and the affidavit and oral evidence given by the appellant 
could have been given at the trial, and is manifestly not fresh evidence. 


63 The probative force of the new evidence depends in large measure on the appellant’s credibility and 
reliability. His explanations and interpretations of these and related documents are contradicted at critical 
points, on which there is no independent evidence to supporthim. The appellant’s contradictory evidence about 
the email of 11.16 am on 10 September 2003 raises doubts about his credibility, as does his evidence based on 
the calls from his mobile phone that day. 
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64 Even if the new evidence about the disputed email was truly fresh it has not been positively shown to 
be credible and the appellant has failed to establish that its reception at the trial would probably have produced a 
different result. The additional evidence should therefore be rejected and the appeal should be determined on 
the evidence before the trial Judge. 


65 The appellant’s challenges to the Judge’s findings of guilt can be grouped as follows: 


(i) The construction of the undertakings to the Court, and the plaintiffs conduct of the trial in 
relation thereto. 


(ii) The findings that the appellant was carrying on business in competition with the company and 
approaching its customers. 


(iii) The finding that News Ltd was a customer of the company. 


66 The undertakings are summarised in para 1. The appellant argued that they were too ambiguous to be 
enforced because they incorporated or arguably incorporated the definition of business and the covenant not to 
approach customers of the company contained in the shareholder’s agreement between the company, Mr and 
Mrs Wright, and Mr Ryan. The contractualdefinition of associates was incorporated in the undertakings but 
they were otherwise self-contained, clear and unambiguous. The Judge’s decision to that effect was correct. 


67 The appellant relied before us, as he had relied below, on the opening by counsel for the plaintiffs 
before Gzell J (black 3) where he said that the undertakings were based on the shareholder’s agreement and in 
the event of ambiguity the relevant factual matrix would include thatagreement. This was nota concession that 
the undertakings incorporated otherterms of the agreement or that they were ambiguous. Since the 
undertakings were clear and unambiguous the argument based on the opening of counsel for the plaintiffs is 
without substance. 


68 The appellant’s activities summarised above [paras 33-5] establish repetitive and continuous conduct of 
a kind which excludes as unreasonable any explanation otherthan the carrying on ofa business: Martin v 
Osborne (1936) 55 CLR 367, 375-6 para 38, and Hope v Bathurst City Council (1980) 140 CLR 1, 8-9. 


69 The same activities also establish a breach of the undertaking not to approach customers. The appellant 
submitted that this would only be breached if he initiated the approach. While accidental or casualcontact in 
the street or at a social function would not be a breach without more the appellant’s activities proved in evidence 
went far beyond this. 


70 An approach to the appellant initiated by a customer would not permit him to respond by approaching 
that customer either then or later in the course of continuing the association. In my judgment the undertaking 
did not even permit him to respond positively to a business approach from such a customer as that itself would 
be an approach within the meaning of this undertaking. The relevant principles which govern the construction 
ofa restraint of trade clause, or undertaking in such terms are those applied in Barrett v Echo Personnel Pty Ltd 
(24 November 1998, Court of Appeal, unreported) where Stein JA, delivering the principal judgment of the 
Court, said: 


“The appellant’s submission amounts to this. One should construe ‘solicit’ in the agreement 
in a highly mechanical fashion. You simply ask, who made the first approach? If an old 
customer made the first approach to a former employee, then whatever the facts thereafter 
which might lead to business being done, there cannot be solicitation. This cannot be correct. 
One may acknowledge that in most instances the first approach will be made by the ex- 
employee to the former customer. Commonsense however demands that this not be the 
exclusive means by which a solicitation may occur. A simple illustration will suffice as to 
why this is so. Assume a customer finds out, quite accidentally, that a former employee with 
whom it dealt had left his principal and established a business of his own and says ‘let us have 
a proposal’. The ex-employee then submits a proposal in very favourable terms and makes a 
presentation to the client which convinces it to award the contract to him. Should the fact of 
the first approach negative any solicitation or enticing away? I think not.” 
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71 One of the meanings of approach in the Macquarie Dictionary is “to make a proposalto”. The 
appellant certainly did this in relation to RIC in the emails of 10 September 2003 and by necessary inference he 
did so to the other customers with whom he had the contacts proved in evidence. The challenge to the 
conviction for breach of the second undertaking also fails. 


2: The submission that News Ltd was not a customer of the company was without substance. This was a 
pure question of fact and the Judge accepted the evidence of Mr Ryan on the point and was entitled to do so. 


73 The appeal therefore fails on all grounds and must be dismissed with costs. 


74 HODGSON JA: I agree with the orders proposed by Handley JA and with his reasons. I would add 
some short comments. 


75 Had the appellant wished to make out a substantial case that the disputed email, alone of the emails 
purportedly sent by him on 10 September 2003, was not and indeed could not have been sent by him, one would 
have expected evidence that the disputed email was sent by a different path from the admitted emails. There 
was no such evidence. 


76 In his affidavit of 14 October 2004, the appellant said that the email purportedly sent at 11.16am on 10 
September 2003 was a response toa question from its recipient: he did not deny sending it on that day, and he 

did not explicitly deny doing so in the affidavits read before this Court. That email itself was a plain breach of 
the undertaking not to approach customers, and neither the proposed fresh evidence nor the other arguments on 
appeal make out any case to the contrary. 


77 I agree with Handley JA that the proposed fresh evidence lacked the necessary credibility and 
materiality, particularly in circumstances where it depended in essential respects on the appellant’s own 
credibility, which was strongly underchallenge. 


78 HUNT AJA: IJ agree with Handley JA. 
FOC HOOK OK aK aK aK ok 
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